Sigma detection rules, expert-reviewed

Windows WMIC Process Creation Recon for Unquoted Service Paths

Flags wmic.exe service queries requesting name/displayname/pathname/startmode to support unquoted service path reconnaissance.

Windows Hotfix Inventory Recon via wmic.exe qfe

Detects wmic.exe executions with "qfe" used to enumerate installed Windows hotfixes.

Windows CLI Enumeration of 3rd-Party Credential Registry Keys

Alerts when Windows processes use command-line queries to enumerate credential-containing third-party registry keys.

Windows Dsacls.EXE Password Spraying Check via /user and /passwd

Flags dsacls.exe executions that specify both /user: and /passwd:, consistent with password spraying attempts.

Windows: dsacls.exe used to grant potentially over-permissive access rights

Alerts on dsacls.exe commands using /G to grant wide or permissive ACL permissions.

PowerShell WMI Service Enumeration for Unquoted Service Path Recon

Flags PowerShell WMI queries for Win32_Service fields to enumerate potential unquoted service path issues.

Windows Registry: New W32Time TimeProvider DllName Values Set Under Services\W32Time\TimeProvider

Alerts on new or changed W32Time TimeProvider DllName registry values under Services\W32Time\TimeProvider.

Windows: Chromium-Based Browser Launched via Script Host with --load-extension

Flags Windows process creation where Chromium browsers are spawned with --load-extension= from common script/LOLBins parents.

Windows Chromium-Based Browser Launched With --load-extension Flag

Alerts when a Chromium-based browser starts with --load-extension= to load a custom extension.

Windows File Creation: Suspicious Double-Extension Filenames Ending in Script/Archive/Executable Types

Alerts on Windows filenames that look like double extensions, including .rar.exe/.zip.exe masquerading patterns.

Windows: msdt.exe Loads sdiageng.dll via Image Load Events

Flags msdt.exe image-load events that load sdiageng.dll, a behavior commonly associated with DLL side-loading abuse.

Windows Process Creation: Sysinternals PsService (PsService*.exe) Execution

Alerts on execution of Sysinternals PsService (PsService*.exe) on Windows, which can support service discovery and tampering.

Windows OpenConsole LOLBIN Execution via Process Creation

Alerts when OpenConsole.exe runs (outside a specific Windows Terminal path), potentially used to bypass application whitelisting.

Windows Registry: Enable ScriptedDiagnostics TurnOffCheck DWORD via Policies

Flags registry policy enabling ScriptedDiagnostics TurnOffCheck (DWORD 0x00000001) on Windows.

Windows: Execution of Pcalua.exe with -a Argument

Flags Pcalua.exe executions containing " -a" that may indicate indirect command execution on Windows.